fix(ci): replace close/reopen hack with workflow_dispatch for bot PRs

[John-David Dalton (jdalton)]

Summary

• Add actions: write permission to trigger CI via workflow_dispatch
• Branch from HEAD~1 so PR is behind main, enabling the "Update branch" button
• Add "Trigger CI checks" step using gh workflow run ci.yml
• Enhance job summary with PR link and enterprise workflow instructions

Ported from SocketDev/socket-sdk-js#592.

Test plan

• Trigger the weekly-update workflow manually via workflow_dispatch
• Verify CI is triggered on the bot PR branch
• Verify the "Update branch" button appears on the created PR

---

Note

^{Cursor Bugbot is generating a summary for commit e337f8b. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: HEAD~1 branching breaks validation diff comparison
  • Changed git diff --name-only origin/main..HEAD to use three-dot syntax (origin/main...HEAD) which compares the merge-base against HEAD, so only Claude's branch changes are validated instead of also including the skipped commit's changes.

Or push these changes by commenting:

@cursor push 35b046df68

Preview (35b046df68)

diff --git a/.github/workflows/weekly-update.yml b/.github/workflows/weekly-update.yml
--- a/.github/workflows/weekly-update.yml
+++ b/.github/workflows/weekly-update.yml
@@ -224,7 +224,7 @@
         if: steps.final.outputs.success == 'true'
         run: |
           UNEXPECTED=""
-          for file in $(git diff --name-only origin/main..HEAD); do
+          for file in $(git diff --name-only origin/main...HEAD); do
             case "$file" in
               package.json|*/package.json|pnpm-lock.yaml|*/pnpm-lock.yaml|.npmrc|pnpm-workspace.yaml) ;;
               src/*|test/*) ;;

_{You can send follow-ups to the cloud agent here.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit e337f8b. Configure here.}